PBS

Merchant Guide for SSL Based Card Acquiring (PSIP)

26 September 2007 Version 3.6

1 Contents

2 Synopsis

3 Purpose

4 Introduction

4.1 Overview of PSIP Shopping and Payment

4.2 Cardholder shops from his PC

4.3 Transaction types

4.3.1 Authorization

4.3.2 Authorization Reversal

4.3.3 Capture

4.3.4 Return/Credit

4.4 Detailed description of Shopping and Payment

4.4.1 Basic features of PSIP for eCommerce

4.4.2 Transaction balancing

4.4.3 The basic message flow extended for IA in ecommerce environments

4.4.4 Implementing eDankort and 3-D Secure using the IA extension

4.4.5 Mandatory content of merchant "checkout" page - eDankort

4.4.6 Implementing 3-D Secure

4.4.7 Recurring transactions (subscription)

4.4.8 Recurring transactions (subscription)

4.4.9 Return/Credit

4.4.10 Clearing methods

4.5 Error situations, roles and responsibilities

5 Protocol Specifications

5.1 Network Layer

5.2 SSL Layer

5.3 Message format and types

5.3.1 Introduction

5.3.2 Message Format

5.3.3 PGTM Routing header

5.3.4 PSIP header

5.3.5 PSIP messages

5.3.6 ISO 8583 v.1

5.3.7 PSIP Authorization Request

5.3.8 PSIP Authorization Response

5.3.9 PSIP Reversal Advice

5.3.10 PSIP Reversal Advice Response

5.3.11 PSIP Capture Request

5.3.12 PSIP Capture Response

5.3.13 Definition TAG/LENGTH/VALUE data element

5.3.14 Tag definition

5.3.15 Examples: Reconciliation Counter Id, Reconciliation Counter Name, and Card Name

5.4 Issuer Authentication (IA) messages extension

5.4.1 Data transport/connection

5.4.2 Data dictionary

5.5 Authentication Initialization

5.6 Authentication Decline

5.7 Authentication Approval

6 Security Requirements

6.1 Card Security Programme (The PCI Standard)

7 Requirements to cardholder interface in eCommerce/IA environments

7.1 Order Number

7.2 Expiration Dates

7.3 Card Verification Data (CVD)

7.4 Cardholder Receipt

7.5 Truncation of the Card Number (PAN)

7.6 Displaying secure sessions

Appendix A Action Code

Appendix B PGW Response code

Appendix C Message Samples: eCommerce

C.1 Authorization Request

C.2 Authorization Response

C.3 Capture Request

C.4 Capture Response

Appendix D Rules regarding CVD

D.1 Cards with CVD

Appendix E Authentication processing in 3-D Secure

Appendix F Implementing own MPI